Sidecar-based log rotation for ACS applications

How it works

• If you have a small number of workloads, you can configure a logrotate sidecar for each application to implement log rotation.

• If you have a large number of workloads, you can use a SidecarSet to inject a logrotate sidecar into workloads within a specified scope, such as an entire cluster or a specific namespace.

Configure a logrotate sidecar for an application

The following example deploys the logrotate container as a native sidecar: an init container configured with restartPolicy: Always. For ACS clusters running Kubernetes 1.28 or earlier, you can use the ACS-enhanced environment variable __IS_SIDECAR=true to mark a regular container as a sidecar, allowing you to manage its lifecycle the same way. For more information, see Configure Sidecar container startup and shutdown sequence.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: test-logrotate
  labels:
    app: test
spec:
  replicas: 1 
  selector:
    matchLabels:
      app: test
  template:
    metadata:
      labels:
        app: test
    spec:
      initContainers:
        - name: logrotate
          env:
            - name: CRON_EXPR
              value: "5 * * * *"
            - name: LOGROTATE_LOGFILES
              value: "/var/log/*/*.log"
            - name: LOGROTATE_FILENUM
              value: "5"
            - name: LOGROTATE_FILESIZE
              value: "10M"
            - name: __IGNORE_RESOURCE__
              value: "true"
            - name: __IGNORE_READY__
              value: "true"
          command: [ "sh", "/start.sh" ]
          image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/logrotate:v1.1
          volumeMounts:
            - mountPath: /var/log
              name: shared-log
            - mountPath: /var/lib
              name: logrotate-state
          restartPolicy: Always
          resources:
            limits:
               cpu: 0.25
               memory: 0.5Gi
      containers:
        - name: busybox
          image: mirrors-ssl.aliyuncs.com/busybox:latest
          command: [ "sh", "-c" ]
          args:
            - |
              mkdir /var/log/busybox
              while true; do
                TIMESTAMP=$(date "+%Y-%m-%d %H:%M:%S")
                LOG_LEVEL=$(shuf -n1 -e INFO WARNING ERROR)
                APP_NAME="busybox"
                HOSTNAME=$(hostname)
                MESSAGE=$(shuf -n1 -e "Success" "Timeout" "Database error")
                echo "$TIMESTAMP $HOSTNAME [$LOG_LEVEL] $APP_NAME: $MESSAGE" >> /var/log/busybox/busybox.log
                sleep 1
              done
          volumeMounts:
            - mountPath: /var/log
              name: shared-log
      volumes:
        ## Collect stdout logs.
        - emptyDir:
          name: shared-log
        - emptyDir:
          name: logrotate-state

The following table describes the key environment variables.

Inject logrotate sidecars with a SidecarSet

The OpenKruise SidecarSet manages sidecar containers with automatic injection and independent upgrades. The following SidecarSet injects the logrotate sidecar into all Pods labeled with kruise.io/inject-logrotate: "true". It also enables the shared volume policy shareVolumePolicy.type=enabled, which automatically mounts all Pod volumeMounts into the sidecar. If the injected Pods share a common volume name, you can also declare that name in the SidecarSet.

apiVersion: apps.kruise.io/v1alpha1
kind: SidecarSet
metadata:
  name: logrotate-sidecarset
spec:
  selector:
    matchLabels:
      kruise.io/inject-logrotate: "true"
  updateStrategy: 
    type: NotUpdate
  initContainers:
    - name: logrotate
      env:
        - name: CRON_EXPR
          value: "5 * * * *"
        - name: LOGROTATE_LOGFILES
          value: "/var/log/*/*.log"
        - name: LOGROTATE_FILENUM
          value: "5"
        - name: LOGROTATE_FILESIZE
          value: "10M"
        - name: __IGNORE_RESOURCE__
          value: "true"
      command: [ "sh", "/start.sh" ]
      image: registry-cn-hangzhou.ack.aliyuncs.com/ack-demo/logrotate:v1.1
      shareVolumePolicy:
        type: enabled
      volumeMounts:
        - mountPath: /var/lib/
          name: logrotate-state
      restartPolicy: Always
      resources:
        limits:
           cpu: 0.25
           memory: 0.5Gi
  volumes:
    - name: logrotate-state
      emptyDir: {}

Related information

The following Dockerfile and script build the logrotate image. Modify them to meet your requirements.

• Dockerfile:

  FROM registry-cn-hangzhou.ack.aliyuncs.com/dev/alpine:3.20-update
  RUN apk --update add bash logrotate
  ADD start.sh /start.sh
  CMD ["/start.sh"]

• start.sh:

  #!/bin/sh
  LOGROTATE_LOGFILES="${LOGROTATE_LOGFILES:?Files for rotating must be given}"
  LOGROTATE_FILESIZE="${LOGROTATE_FILESIZE:-10M}"
  LOGROTATE_FILENUM="${LOGROTATE_FILENUM:-5}"
  cat > /etc/logrotate.conf << EOF
  ${LOGROTATE_LOGFILES}
  {
    size ${LOGROTATE_FILESIZE}
    missingok
    notifempty
    copytruncate
    rotate ${LOGROTATE_FILENUM}
  }
  EOF
  if [ -z "$CRON_EXPR" ]; then
    CRON_EXPR="0 6 * * *"
    echo "CRON_EXPR environment variable is not set. Set to default: $CRON_EXPR"
  else
    echo "CRON_EXPR environment variable set to $CRON_EXPR"
  fi
  echo "$CRON_EXPR	/usr/sbin/logrotate -v /etc/logrotate.conf" >> /etc/crontabs/root
  (crond -f) & CRONPID=$!
  trap "kill $CRONPID; wait $CRONPID" SIGINT SIGTERM
  wait $CRONPID